Trust center.
Where your data lives. How it's protected. Who processes it.
Aviation safety data is regulated by national civil aviation authorities (FAA, EASA, Transport Canada, ICAO Annex 19). Every page in this tenant ships with the audit trail, retention controls, and confidentiality posture a safety regulator would expect.
Data residency
At rest + in transit
- Database — AES-256 disk encryption + row-level isolation per operator
- File storage — AES-256 object encryption
- Secrets (webhook secrets, API keys) — hashed at rest · plaintext returned once at create
- Reporter identity (anonymous + confidential modes) — dropped at write time, NOT encrypted-then-released; identity is unrecoverable by design
- TLS 1.3 enforced edge-to-origin
- HSTS preload · 1-year max-age · includeSubDomains
- Outbound webhooks signed with HMAC-SHA256 — receiver verifies via shared secret
- Background-worker events signed by the runtime — replay-resistant
5-layer defense in depth
Single-database multi-tenant. Defense lives in 5 layers — if any one fails, the next still holds.
Every server-side endpoint filters records by the calling operator's org ID. Enforced by middleware on every request — no endpoint touches tenant data without a tenant in context.
Every database query that touches an org-scoped table includes the operator's org ID as part of the WHERE clause. A CI gate blocks any new server endpoint that lacks the filter.
Background workers wrap every cross-tenant operation in a per-org context. Even cross-tenant aggregations cannot read across operators — the context resets between operators.
External-facing database roles cannot read any tenant data. The path is closed at the database role level, not just the application — even if a public client key were leaked, it would not read across operators.
Row-level security is enabled and forced on every tenant-scoped table. The database itself refuses cross-tenant reads — defense in depth for the day any earlier layer might fail.
Methods supported
Pick the one your IdP uses; mix and match per tenant.
Categories that touch your data
Service categories in the processing chain. Vendor names + DPAs in Privacy 09 + Terms 09.
Every mutation is logged
Every server-side change to your data writes an audit-log row. Coverage is enforced by a CI gate — no mutation ships without one.
Self-serve viewer at /settings/audit-log — filter by actor, action, entity, time window. Export to JSON / CSV.
Defaults to 365 days. Per-tenant retention controls live at /settings/data — within regulatory minimums set by your civil aviation authority.
Where we stand
The platform is built to support audits by national civil aviation authorities (FAA Part 5 SMS, EASA Part-ORO Appendix 4, Transport Canada CAR 705, ICAO Annex 19). The audit-log surface, retention controls, and reporter-confidentiality model are designed for a regulator showing up with a notebook.
We are running our SOC2 Type 2 readiness audit in 2026. Procurement teams that need a pre-audit questionnaire response can email trust@eaviora.com — we will share our control matrix.
DPA available on request — email privacy@eaviora.com. Standard Contractual Clauses available for cross-border transfers (US sub-processors above).
Export everything, any time
Your data is yours. Trigger a full export any time.
/settings/data → EXPORT EVERYTHING queues a complete JSON bundle of every record in your tenant: occurrences, hazards, SPIs, actions, audits, investigations, documents, training records and the full audit log. The bundle is built asynchronously and delivered as a 7-day signed download link by email. Re-importable into any other vendor or held for your own archives. No support ticket required.
Found something? Tell us.
Email security@eaviora.com with reproduction steps, the affected tenant (your tenant ID is sufficient), and your preferred disclosure window. We acknowledge within 24 hours, ship a fix or mitigation within 7 days for Critical / High, and credit you in the advisory unless you ask us not to. We do not litigate good-faith research.